{"record":{"id":"c2a9d95305f60a31","repo":"kubernetes/kubernetes","slug":"subject-organization-is-not-system-nodes","errorCode":null,"errorMessage":"subject organization is not system:nodes","messagePattern":"subject organization is not system:nodes","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/apis/certificates/helpers.go","lineNumber":44,"sourceCode":"\n\t\"k8s.io/apimachinery/pkg/util/sets\"\n)\n\n// ParseCSR extracts the CSR from the bytes and decodes it.\nfunc ParseCSR(pemBytes []byte) (*x509.CertificateRequest, error) {\n\tblock, _ := pem.Decode(pemBytes)\n\tif block == nil || block.Type != \"CERTIFICATE REQUEST\" {\n\t\treturn nil, errors.New(\"PEM block type must be CERTIFICATE REQUEST\")\n\t}\n\tcsr, err := x509.ParseCertificateRequest(block.Bytes)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\treturn csr, nil\n}\n\nvar (\n\torganizationNotSystemNodesErr = fmt.Errorf(\"subject organization is not system:nodes\")\n\tcommonNameNotSystemNode       = fmt.Errorf(\"subject common name does not begin with system:node:\")\n\tdnsOrIPSANRequiredErr         = fmt.Errorf(\"DNS or IP subjectAltName is required\")\n\tdnsSANNotAllowedErr           = fmt.Errorf(\"DNS subjectAltNames are not allowed\")\n\temailSANNotAllowedErr         = fmt.Errorf(\"Email subjectAltNames are not allowed\")\n\tipSANNotAllowedErr            = fmt.Errorf(\"IP subjectAltNames are not allowed\")\n\turiSANNotAllowedErr           = fmt.Errorf(\"URI subjectAltNames are not allowed\")\n)\n\nvar (\n\tkubeletServingRequiredUsages = sets.NewString(\n\t\tstring(UsageDigitalSignature),\n\t\tstring(UsageKeyEncipherment),\n\t\tstring(UsageServerAuth),\n\t)\n\tkubeletServingRequiredUsagesNoRSA = sets.NewString(\n\t\tstring(UsageDigitalSignature),\n\t\tstring(UsageServerAuth),\n\t)","sourceCodeStart":26,"sourceCodeEnd":62,"githubUrl":"https://github.com/kubernetes/kubernetes/blob/b882c60b4023bdf09264c2d5d30a2cadebc240fb/pkg/apis/certificates/helpers.go#L26-L62","documentation":"Returned by ValidateKubeletServingCSR / ValidateKubeletClientCSR when the CSR's Subject.Organization is not exactly the single-element slice [\"system:nodes\"]. Kubelet-serving and kubelet-client CSRs are strictly scoped to the system:nodes group; any other (or missing) organization is rejected.","triggerScenarios":"Calling certificates.ValidateKubeletServingCSR or ValidateKubeletClientCSR with an x509.CertificateRequest whose Subject.Organization differs from [\"system:nodes\"] (empty, multi-element, or a different value).","commonSituations":"A kubelet bootstrapping with a wrong/missing org in its CSR config; a custom CSR generator that sets O to the node's cloud group; TLS bootstrap misconfiguration in kubelet flags.","solutions":["Set the CSR Subject.Organization to exactly []string{\"system:nodes\"}.","Verify the kubelet's --bootstrap-kubeconfig and node registration config produce the correct Subject.","Regenerate the CSR after fixing the Subject."],"exampleFix":"// before\ntemplate := x509.CertificateRequest{\n    Subject: pkix.Name{CommonName: \"system:node:node1\", Organization: []string{\"kube-system\"}},\n}\n// after\ntemplate := x509.CertificateRequest{\n    Subject: pkix.Name{CommonName: \"system:node:node1\", Organization: []string{\"system:nodes\"}},\n}","handlingStrategy":"validation","validationCode":"func hasSystemNodesOrg(req *x509.CertificateRequest) bool {\n    return reflect.DeepEqual(req.Subject.Organization, []string{\"system:nodes\"})\n}","typeGuard":"func isKubeletCSRSubject(req *x509.CertificateRequest) bool {\n    return reflect.DeepEqual(req.Subject.Organization, []string{\"system:nodes\"}) &&\n        strings.HasPrefix(req.Subject.CommonName, \"system:node:\")\n}","tryCatchPattern":"if err := certificates.ValidateKubeletServingCSR(csr, usages); err != nil {\n    if errors.Is(err, certificates.ErrOrgNotSystemNodes) { /* fix Subject */ }\n    return err\n}","preventionTips":["Build kubelet CSR templates from a shared helper that always sets Organization=[system:nodes].","Unit-test CSR generation against both Validate functions."],"tags":["certificates","kubelet","csr","tls-bootstrap","authorization"],"analyzedSha":"b882c60b4023bdf09264c2d5d30a2cadebc240fb","analyzedAt":"2026-08-07T04:07:48.144Z","schemaVersion":2},"datasetVersion":"2026-08-07T07:17:06.508Z"}